View EFL (Mark register) in C ++/debug mode

For example, when we use assembly commands such as ADC and SBB, We Have To unbind the content in the flag register (EFL) for the sake of attention. View the value of each flag in binary details. Then these commands that need to use the mark register are clear at a glance. --

I can't wait to write a test code to see the secret:

# Include <iostream>

Int main (void)
{
_ ASM
{
MoV Al, 0xff
MoV DL, 0x01

Add Al, DL
ADC Al, DL
}

Return 0;

}

It should be explained in the form of restrained assembly. Here we want to give a 0xff to Al. Why is it easy for Al to be carried? Of course, you can make other numbers, as long as the sum of the two numbers is carried (Here we want to test the CF bit of carry ). Dl I gave the sum of 0x01 to carry exactly and can test the parity and zero value.

We lay down the breakpoint in the red code above, then run the program to break here, and then open the VC register window, we can see the values of each register. EFL =? The value of the Flag register.

There are two ways to view the value of each flag in the flag register:

First, convert the EFL value to binary, and view the value of a flag bit through binary bit.

2. If no flag is displayed in the register window, right-click the register window and select "flag" to display the flag value, as shown in the following figure:

OV =? Up =? Ei =? PL =? ZR =? AC =? Pe =? Cy =?

Here is a comparison table:

 

 

 

You can compare the bit values of each flag Based on the binary data of EFL.

We can see each value of the flag at the starting breakpoint:

OV = 0 up = 0 Ei = 1 PL = 0 Zr = 0 ac = 0 Pe = 0 Cy = 0

Here, Ei = 1 indicates that the instance is in the interrupted state --..

Let's look at EFL = 0x00000202 (1000000010:

1 0 0 0 0 0 0 1 0

If tf sf zf af pf cf

Only if (EI | di) is 1, and only one of the brackets is used in the VC register window...

Good! After reading the flags, run the Add Al and DL statement following F10.

Look at the value of each flag: ov = 0 up = 0 Ei = 1 PL = 0 Zr = 1 AC = 1 PE = 1 Cy = 1

Let's take a look at the value of the Flag register: EFL = 0x00000257 (1001010111)

1 0 0 1 0 1 0 1 1 1

If tf sf zf af pf cf

Here, if indicates that the operation has been interrupted, ZF indicates that the destination operand result is zero, and AF indicates that (Al is a byte) is added to half (4 bits low) to the other half (4 bits high) carry, which can also represent whether to borrow (subtraction ). PF indicates an even number. Cf indicates that carry has occurred. It can also represent a bits.

Then press F10 to execute the ADC Al and DL. The ADC is the addition of the incoming bit. The result is Al = Al + dl + CF.

At this time, Al: 0 + 0x1 + 1 = 0x02.

Flag value: ov = 0 up = 0 Ei = 1 PL = 0 Zr = 0 ac = 0 Pe = 0 Cy = 0 I will not explain it here --

In particular:

DF: indicates the direction of the control flag. It is used to control the direction of processing information in the string processing command. When DF is set to 1, the address change register Si and Di are reduced after each operation, so that the string processing starts from the high address to the low address. When DF is 0, the opposite is true ..

TF: When TF is set to 1, the CPU enters the single-step execution mode, that is, each execution of a command generates a single-step interruption request. This method is mainly used for program debugging.

Here we want to obtain the value of the Mark register with the following commands:

Transmit the lahf flag register and load the flag into ah.
Send the sahf flag register and load the ah content into the flag register.
Pushf marks the inbound stack.
Popf marks the exit of the stack.
Pushd 32-bit flag into the stack.
Popd 32-bit marks the stack.

The above af bit reminds me of a common method to carry or borrow digits using ADC or SBB, we can add or subtract two 4-byte data, which can be 2 bytes in height and 2 bytes in height. The ADC/SBB can be used to obtain the CF value when calculating the 2-byte height to add/subtract it for carry or borrow.

For example:

MoV ax, low1

Add ax, low2

MoV sumlow, ax

MoV ax, high1

ADC ax, high2

MoV sumhigh, ax

In this way, carry is implemented. low1 and low2 indicate the lower 2 bytes of the first number and the second number respectively. high1 and high2 indicate the higher 2 bytes of the first number and the second number respectively. When add ax and low2 generate carry, cf = 1. The ADC will be used to obtain the CF value when adding two bytes in height. Sumhigh = high1 + high2 + CF. The final number is the combination of the sumhigh and sumlow. Shape:

DWORD Var = 0;

Word sumhigh = 0;

Word sumlow = 0;

C ++:

VaR | = sumhigh;

VaR <= 16;

VaR | = sumlow;

ASM:

Movzx eax, word PTR [sumhigh]
SHL eax, 10 h
Or eax, dword ptr [sumlow]
MoV var, eax

This enables carry. The reason for the bid is the same. I will not discuss it here .. --

I finally finished writing ~~ Exhausted .. I hope you can correct any mistakes --